T09 · Insecure Skill Coding Practices
Error
- Location
src/cli.ts:52- Finding
Wallet Passwords and Recovery Mnemonics Can Be Exposed Through Command-Line Arguments
- Content
View full analysis
{ // For now, use env var or argument - interactive prompt needs enquirer const password = process.env.CLAWPURSE_PASSWORD || getArg('--password'); if (!password) { console.error(`Error: Password required. Set CLAWPURSE_PASSWORD env var or use --password flag`); process.exit(1); } return password; } ``` ```typescript const mnemonic = getArg('--mnemonic') || process.env.CLAWPURSE_MNEMONIC; if (!mnemonic) { console.error('Error: Mnemonic required. Use --mnemonic or set CLAWPURSE_MNEMONIC'); process.exit(1); } ``` ### Technical Analysis The CLI explicitly accepts wallet passwords through `--password` and complete BIP-39 recovery phrases through `--mnemonic`. Process arguments are not an appropriate secret-transport mechanism because they may be recorded or exposed through: - Shell history files. - Process inspection utilities and `/proc` interfaces. - Audit and endpoint-monitoring systems. - CI/CD command logs. - Container or orchestration metadata. - Debug output and command wrappers. A recovery mnemonic grants full and generally irreversible control over the wallet. A disclosed password can be combined with access to `keystore.enc` to decrypt the mnemonic. Although environment variables are preferable to command-line arguments in some environments, they may also be exposed through process inspection, crash reports, or deployment configuration. The declared wallet functionality requires access to these secrets, but it does not require placing them in globally observable command-line metadata. ### Attack Path 1. A user or automated Agent executes a command such as: ```bash clawpurse import --mnemonic "word1 word2 ..." --password "wallet- ...[truncated 1038 chars]- Remediation
View remediation